Route Origin Authorization

$ rpki-client -vvf rpki.apnic.net/member_repository/A91CF83F/89238ECCEF4F11E99DE47F0CC4F9AE02/3AF0DD44EF5011E99E0E250DC4F9AE02.roa
File:                     3AF0DD44EF5011E99E0E250DC4F9AE02.roa (raw, json)
Hash identifier:          0CWyWXDWa5Vx+bGJzJ/3Du1o7MXNUN4SrriZqBCIgoo=
Subject key identifier:   74:B1:EB:94:48:3D:2B:25:1D:9A:AF:B3:5A:5B:62:1C:1F:6A:F6:DD
Certificate issuer:       /CN=A91CF83F/serialNumber=929889BB5D34E860ACBF70894337A462C1D6AC2E
Certificate serial:       0B1F
Authority key identifier: 92:98:89:BB:5D:34:E8:60:AC:BF:70:89:43:37:A4:62:C1:D6:AC:2E
Authority info access:    rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/kpiJu1006GCsv3CJQzekYsHWrC4.cer
Subject info access:      rsync://rpki.apnic.net/member_repository/A91CF83F/89238ECCEF4F11E99DE47F0CC4F9AE02/3AF0DD44EF5011E99E0E250DC4F9AE02.roa
Signing time:             Fri 24 Mar 2023 19:46:49 +0000
ROA not before:           Fri 24 Mar 2023 19:46:49 +0000
ROA not after:            Sun 31 Mar 2024 00:00:00 +0000
asID:                     135019
IP address blocks:        103.205.232.0/22 maxlen: 24
                          115.42.52.0/22 maxlen: 24
                          2400:b140::/32 maxlen: 32

Validation:               Failed, RFC 3779 resource not subset of parent's resources

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 2847 (0xb1f)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=A91CF83F/serialNumber=929889BB5D34E860ACBF70894337A462C1D6AC2E
        Validity
            Not Before: Mar 24 19:46:49 2023 GMT
            Not After : Mar 31 00:00:00 2024 GMT
        Subject: CN=641dfe29-af8f
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:c5:f2:45:3f:78:95:fd:15:44:d1:ad:88:75:a8:
                    6f:a3:af:b8:78:2a:69:c5:7a:3a:d9:11:be:6f:a8:
                    ff:de:d5:2e:ad:8d:42:b7:eb:2b:a8:91:88:cf:27:
                    94:1e:52:c0:a2:87:17:c9:94:7d:30:56:62:25:2e:
                    bc:17:5e:23:b2:06:0e:8a:ef:05:6f:0e:3a:2c:a2:
                    6b:e6:1f:54:0a:8b:09:4b:77:f3:fd:5e:cc:37:ab:
                    9a:b4:87:95:e4:e3:7b:12:8e:b9:cb:86:76:a2:e5:
                    88:04:5e:a0:28:f0:bb:c9:9c:0c:ae:94:57:b4:96:
                    12:00:ff:6b:56:01:aa:d9:6b:2c:f6:65:cb:f1:4a:
                    a7:71:bb:b2:10:b7:dc:ba:f4:b9:00:bc:36:71:d3:
                    6a:65:8e:3e:da:3b:e5:b3:9b:90:7f:0f:9f:bd:d2:
                    f8:ef:da:ac:03:70:fc:f9:eb:34:f8:09:55:b3:8b:
                    22:ec:f1:74:7e:ae:01:d7:ed:b5:a0:2c:00:2f:dd:
                    66:d4:6f:c9:41:6e:68:6e:06:76:13:97:6a:61:9b:
                    49:db:ab:5a:0e:90:a6:05:28:48:f8:92:ff:d5:5d:
                    da:22:e6:7f:81:32:25:02:5a:80:2f:4d:a3:9d:fb:
                    bf:7c:55:4a:bd:01:53:1f:9f:b9:df:d7:a8:81:5f:
                    52:c1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                74:B1:EB:94:48:3D:2B:25:1D:9A:AF:B3:5A:5B:62:1C:1F:6A:F6:DD
            X509v3 Authority Key Identifier:
                keyid:92:98:89:BB:5D:34:E8:60:AC:BF:70:89:43:37:A4:62:C1:D6:AC:2E

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points:

                Full Name:
                  URI:rsync://rpki.apnic.net/member_repository/A91CF83F/89238ECCEF4F11E99DE47F0CC4F9AE02/kpiJu1006GCsv3CJQzekYsHWrC4.crl

            Authority Information Access:
                CA Issuers - URI:rsync://rpki.apnic.net/repository/B527EF581D6611E2BB468F7C72FD1FF2/kpiJu1006GCsv3CJQzekYsHWrC4.cer

            X509v3 Certificate Policies: critical
                Policy: ipAddr-asNumber
                  CPS: https://www.apnic.net/RPKI/CPS.pdf

            Subject Information Access:
                Signed Object - URI:rsync://rpki.apnic.net/member_repository/A91CF83F/89238ECCEF4F11E99DE47F0CC4F9AE02/3AF0DD44EF5011E99E0E250DC4F9AE02.roa
                RPKI Notify - URI:https://rrdp.apnic.net/notification.xml

            sbgp-ipAddrBlock: critical
                IPv4:
                  103.205.232.0/22
                  115.42.52.0/22
                IPv6:
                  2400:b140::/32

    Signature Algorithm: sha256WithRSAEncryption
         07:03:eb:05:ab:13:75:3c:84:9f:10:c7:8c:e1:6c:f6:e3:cc:
         aa:8b:6a:fb:ec:63:ba:69:d7:ef:ad:07:fc:8c:5c:f8:4e:f7:
         5f:01:d1:81:5d:87:7a:59:1f:04:a2:47:82:9d:ae:65:14:94:
         6e:09:26:61:dc:5d:7a:75:c3:89:04:42:be:fc:c2:a8:5c:65:
         de:8a:4b:e9:9e:07:92:e3:f8:50:7c:9e:06:fb:09:f5:aa:c1:
         2f:12:fb:2d:11:7f:7a:d2:58:6a:34:6d:22:30:3a:f5:6e:d5:
         7f:13:c8:9d:ba:09:b2:69:e5:10:00:67:5e:3b:a9:d3:2d:d8:
         ff:83:d8:84:cd:38:4d:29:00:ca:5d:e0:47:69:ac:76:bf:08:
         55:a8:14:6a:c5:01:c6:c7:f6:f7:7a:5b:7e:f9:45:5e:c5:04:
         66:c4:9e:7d:29:b8:b8:ec:4c:e1:f0:01:5b:19:5d:6d:72:b7:
         75:9c:23:f1:3c:a8:83:89:31:2b:c1:3a:dd:48:06:e7:cf:fd:
         3b:6e:e0:8d:ea:77:f0:23:bb:15:f9:9a:46:1f:c2:5b:77:63:
         cf:19:98:ed:b8:3a:f4:c0:04:eb:5e:9a:7a:67:c3:16:ff:19:
         b0:93:0a:c9:dc:f8:55:d5:50:ac:33:e8:f9:d4:71:54:cc:39:
         55:6c:f7:83
-----BEGIN CERTIFICATE-----
MIIFhjCCBG6gAwIBAgICCx8wDQYJKoZIhvcNAQELBQAwRjERMA8GA1UEAxMIQTkx
Q0Y4M0YxMTAvBgNVBAUTKDkyOTg4OUJCNUQzNEU4NjBBQ0JGNzA4OTQzMzdBNDYy
QzFENkFDMkUwHhcNMjMwMzI0MTk0NjQ5WhcNMjQwMzMxMDAwMDAwWjAYMRYwFAYD
VQQDEw02NDFkZmUyOS1hZjhmMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAxfJFP3iV/RVE0a2Idahvo6+4eCppxXo62RG+b6j/3tUurY1Ct+srqJGIzyeU
HlLAoocXyZR9MFZiJS68F14jsgYOiu8Fbw46LKJr5h9UCosJS3fz/V7MN6uatIeV
5ON7Eo65y4Z2ouWIBF6gKPC7yZwMrpRXtJYSAP9rVgGq2Wss9mXL8UqncbuyELfc
uvS5ALw2cdNqZY4+2jvls5uQfw+fvdL479qsA3D8+es0+AlVs4si7PF0fq4B1+21
oCwAL91m1G/JQW5obgZ2E5dqYZtJ26taDpCmBShI+JL/1V3aIuZ/gTIlAlqAL02j
nfu/fFVKvQFTH5+539eogV9SwQIDAQABo4ICqjCCAqYwHQYDVR0OBBYEFHSx65RI
PSslHZqvs1pbYhwfavbdMB8GA1UdIwQYMBaAFJKYibtdNOhgrL9wiUM3pGLB1qwu
MA4GA1UdDwEB/wQEAwIHgDCBgwYDVR0fBHwwejB4oHagdIZycnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9tZW1iZXJfcmVwb3NpdG9yeS9BOTFDRjgzRi84OTIzOEVDQ0VG
NEYxMUU5OURFNDdGMENDNEY5QUUwMi9rcGlKdTEwMDZHQ3N2M0NKUXpla1lzSFdy
QzQuY3JsMH4GCCsGAQUFBwEBBHIwcDBuBggrBgEFBQcwAoZicnN5bmM6Ly9ycGtp
LmFwbmljLm5ldC9yZXBvc2l0b3J5L0I1MjdFRjU4MUQ2NjExRTJCQjQ2OEY3Qzcy
RkQxRkYyL2twaUp1MTAwNkdDc3YzQ0pRemVrWXNIV3JDNC5jZXIwSgYDVR0gAQH/
BEAwPjA8BggrBgEFBQcOAjAwMC4GCCsGAQUFBwIBFiJodHRwczovL3d3dy5hcG5p
Yy5uZXQvUlBLSS9DUFMucGRmMIHLBggrBgEFBQcBCwSBvjCBuzCBgwYIKwYBBQUH
MAuGd3JzeW5jOi8vcnBraS5hcG5pYy5uZXQvbWVtYmVyX3JlcG9zaXRvcnkvQTkx
Q0Y4M0YvODkyMzhFQ0NFRjRGMTFFOTlERTQ3RjBDQzRGOUFFMDIvM0FGMERENDRF
RjUwMTFFOTlFMEUyNTBEQzRGOUFFMDIucm9hMDMGCCsGAQUFBzANhidodHRwczov
L3JyZHAuYXBuaWMubmV0L25vdGlmaWNhdGlvbi54bWwwNAYIKwYBBQUHAQcBAf8E
JTAjMBIEAgABMAwDBAJnzegDBAJzKjQwDQQCAAIwBwMFACQAsUAwDQYJKoZIhvcN
AQELBQADggEBAAcD6wWrE3U8hJ8Qx4zhbPbjzKqLavvsY7pp1++tB/yMXPhO918B
0YFdh3pZHwSiR4KdrmUUlG4JJmHcXXp1w4kEQr78wqhcZd6KS+meB5Lj+FB8ngb7
CfWqwS8S+y0Rf3rSWGo0bSIwOvVu1X8TyJ26CbJp5RAAZ147qdMt2P+D2ITNOE0p
AMpd4EdprHa/CFWoFGrFAcbH9vd6W375RV7FBGbEnn0puLjsTOHwAVsZXW1yt3Wc
I/E8qIOJMSvBOt1IBufP/Ttu4I3qd/AjuxX5mkYfwlt3Y88ZmO24OvTABOtemnpn
wxb/GbCTCsnc+FXVUKwz6PnUcVTMOVVs94M=
-----END CERTIFICATE-----